Svelte allows spread syntax to inject arbitrary attributes from data into rendered elements. When that data originates from an untrusted source, event handler attributes (e.g. onclick, onmouseover) are rendered as real event listeners in the browser. If an attacker supplies malicious event handlers and the victim’s browser executes the page with JavaScript enabled, the attacker can run arbitrary code in the context of the trust domain. This type of XSS is limited to browsers that have JavaScript active and only triggers if the Svelte hydration does not attach before the event occurs.

The vulnerability affects all releases of Svelte for which the framework’s SSR rendering performs full spread attribute expansion without filtering. Versions prior to the 5.55.7 release contain the flaw; the patch was applied in 5.55.7 to exclude event handler properties from spreads. Applications using the affected library must verify the installed version and upgrade if it falls below 5.55.7.

The CVSS score of 5.1 classifies the flaw as a moderate severity vulnerability. EPSS data is not available, but the issue is not listed in CISA’s KEV catalog, suggesting no known widespread exploitation at the time of this analysis. The exploit requires an attacker to control the data that is spread into the template on a page that has JavaScript enabled, and the event must fire before Svelte’s hydration logic attaches to the element. Attackers can leverage this to execute arbitrary JavaScript within the victim’s browser session, potentially leading to credential theft, session hijacking, or data exfiltration.